The BambuLab Licensing Dispute and the Shadow of Chinese Tech Law

The 3D printing world is having a moment of reckoning. Josef Prusa recently accused BambuLab of violating the AGPL license under which PrusaSlicer was released, specifically pointing to networking code that remains a "binary black box" in BambuStudio. It's a technical dispute on the surface, but it's surfacing deeper questions about transparency, trust, and the legal environments that shape what software companies can actually promise users.

The Licensing Question

BambuStudio is, in technical terms, a fork of PrusaSlicer. When Prusa released their slicer under the GNU Affero General Public License v3, they made a specific choice: anyone who distributes modified versions must make their source code available under the same terms. AGPL is one of the strongest copyleft licenses in existence specifically because it addresses the network use case if you modify the software and run it as a service, you still have to release your changes.

Prusa's complaint centers on networking code that appears to have been modified but whose source remains closed. This isn't a minor technicality. If accurate, it represents a clear license violation. But the response from BambuLab and the speculation from observershas gone somewhere unexpected. Rather than simply addressing the code question, many are asking a different one: why would a company risk this kind of reputational damage over what should be a straightforward compliance issue?

The Five Laws Framework

The answer some are pointing to isn't technical at all. It's legal. Between 2017 and 2023, China enacted a series of laws that, taken together, describe an environment fundamentally different from Western regulatory frameworks. Understanding them isn't speculationthey're published legislation that has been analyzed by legal scholars, security researchers, and governments worldwide.

National Intelligence Law (2017) requires organizations and citizens to "support, assist, and cooperate" with national intelligence work. Critically, it also creates legal liability for disclosing that cooperation occurred. This means a company can be compelled to provide data or access, and legally prevented from telling anyone about it.

Cryptography Law (2020) mandates state approval for commercial encryption and requires companies to provide decryption keys or plaintext when authorities request them. The same state that mandates the encryption holds the keys to unlock it.

Data Security Law (2021) extends Chinese jurisdiction extraterritorially over data related to national security or public interests. The key point: jurisdiction follows the company, not the server location. Data stored on EU or US servers remains under Chinese legal reach if the company is Chinese.

Counter-Espionage Law revision (2023) dramatically expanded the definition of espionage to cover "documents, data, materials, or items related to national security and interests." Industrial data and technical information are explicitly in scope.

Network Product Security Vulnerability regulation (2021) requires that any discovered software vulnerability be reported to the Ministry of Industry and Information Technology within 48 hours. That data flows to CNNVD, operated by the Ministry of State Security's 13th Bureau. Microsoft's threat intelligence team has documented increased Chinese state-hacker zero-day exploitation after this regulation took effect.

Together, these laws create a system with no neutral exits. Cooperation can be compelled. Encryption exists but the keys can be demanded. Jurisdiction follows the company globally. Industrial data is explicitly targeted. And vulnerability discovery becomes a reporting requirement to intelligence services.

What This Means for Software

For a software company operating under these laws, several things become functionally impossible to guarantee to foreign users:

You cannot promise that data won't be shared with Chinese authorities, because the law can compel that sharing and prohibit disclosure of it. You cannot promise that networking code does only what the user sees, because the legal environment may require capabilities that can't be disclosed. You cannot promise that encryption protects data from state access, because the law mandates key provision.

This doesn't mean every Chinese software company is secretly exfiltrating data. It means that under Chinese law, they may not be able to tell you if they were compelled to do so, and the technical means to fulfill such a compulsion can be legally mandated into their products.

The 3D Printing Angle

Why does any of this matter for 3D printing? Because additive manufacturing has been explicitly identified as strategic by China. It joined the "Made in China 2025" plan, and the technology has clear applications in defense manufacturing, rapid prototyping, and industrial production that the Chinese government has stated are national priorities.

A 3D printing company with global reach is handling something more than photos and messages. They're handling the digital instructions for creating physical objects. The STL and G-code files that flow through their software represent manufacturing data. Under the expanded Counter-Espionage Law, that data falls within the broadened definition of materials related to national interests.

The Hard Question

The BambuLab licensing dispute may ultimately be resolved technicallysource code will be released, or it won't, and the AGPL violation will be confirmed or disputed on its legal merits.

But the larger question it surfaces is harder to resolve: what does it mean to trust software from a company operating under a legal framework designed to ensure state access to data and technology, where that access is both mandatory and non-disclosable?

This isn't unique to BambuLab. Any Chinese company with significant software infrastructure faces these same constraints. The difference is that this particular dispute has made the question visible in a specific, technical context where the answer matters to users who care about what their software is actually doing.

For the 3D printing community, the choice isn't about whether Chinese companies make good products. It's about whether the legal environment they operate in allows them to offer the same transparency and guarantees that users in other jurisdictions can demand. The answer, increasingly, appears to be no.